Privacy Notice.

The short version

Base reads the Apple Health data its features need and processes your health data on your devices. If you explicitly start a workout in Base on Apple Watch, Base saves that workout to Apple Health. Base Cardio LLC does not receive that health data. We do not sell personal information, serve ads, or track you across apps or websites. Optional app usage analytics and crash reports are off until you explicitly agree. Base asks once, on the Week screen, and you can change your answer anytime under You → App & privacy → YOUR DATA → Share usage data. The app works without sharing. These reports do not include your Apple Health data. On the website, optional Google Analytics runs only with your separate permission. Two other things reach us only if you chose them: the website waitlist, if you joined it before launch, and emailing us. Apple also passes us some things on its own: crash reports, if you have chosen to share them with developers, and tester information if you use TestFlight. Each of those is described below.

Who we are and what this covers

This notice explains how Base Cardio LLC handles information in the Base iPhone app, Apple Watch app, widgets, complications, and the website at basecardio.com. Base Cardio LLC is the operator and privacy contact.

What the app reads and writes

With your permission, Base reads the following categories from Apple Health:

• Heart rate to calculate time within your selected Zone 2 range.
• Resting heart rate to show a trend and, if you enable Automatic Karvonen, calibrate your range.
• Heart rate variability to show its long-term trend.
• Date of birth to determine age for an age-based heart-rate range.
• Workouts to attribute qualifying minutes to activities such as walks, runs, rides, and hikes.
• Apple Exercise Time to identify qualifying everyday activity outside recorded workouts.

Active energy is not on this list: Base does not read it. Apple, not Base, calculates calories and Fitness-ring progress.

Apple Health is the source of these categories. Base does not request sleep, nutrition, reproductive health, clinical records, location routes, or Health categories that are not needed for these features.

Base asks during setup for permission to save workouts, and saves a completed workout to Apple Health only when you explicitly start it in Base on Apple Watch. This lets the workout appear in your Health history and be available to other apps you authorize through Apple Health. On Apple Watch, Base reads back only the workouts it saved itself, to confirm each one reached Apple Health.

How app health data is handled

Processing happens on your iPhone and Apple Watch. Base keeps a protected local copy of the Health history needed for reliable counting and fast recalculation, including heart-rate timestamps and values, workout and Exercise Time records, and limited source or device metadata. Date-of-birth components are kept separately in a protected local profile.

Base Cardio LLC does not receive, remotely store, or have access to this health data. It is not uploaded to a Base server, stored by us in iCloud, or used for advertising or tracking. The only HealthKit write is a workout that you explicitly start in Base on Apple Watch. Base saves that workout to Apple Health when you finish it. Base does not synthesize or write heart-rate samples, modify existing Health records, or delete Health data.

You control Apple Health permission in iOS Settings. Revoking permission stops future access but does not delete information already stored locally by the app. Deleting Base removes its app container. When Apple Health reports that a previously read record was deleted, Base removes the corresponding local record during reconciliation.

Consumer health data

Some laws define collecting to include accessing or processing consumer health data on a person’s device. Our separate Consumer Health Data Privacy Policy explains the categories, sources, purposes, sharing, sale, and rights that apply under those laws.

App analytics, crash reports, and purchases

Only after you explicitly say yes to sharing usage data, the Base app sends us information about how the app is used — which screens you open, which onboarding step you reach, whether reading Apple Health worked and roughly how long it took, whether you allowed notifications, whether the paywall loaded, whether a purchase or restore succeeded, changes to your plan (free trial, subscription or Lifetime; renewal turned on or off; a billing problem; ended or refunded), and which support or policy links you tap — along with crash and performance diagnostics. Two processors handle this on our behalf: PostHog (EU region) for product analytics and Sentry (EU region) for crashes. No purchase service sits between you and Apple: your subscription status is read on your own device from Apple’s records, and the sales figures we see are Apple’s own, which never identify anyone.

After you agree, the app creates a random identifier and shares it with both processors so the information lines up. It is not an advertising identifier, it is not tied to any account, we do not use it to track you across other apps or websites, and it is deleted when you delete the app. Because that identifier joins the information together, we treat it as linked to you rather than anonymous.

Alongside each of those events, the analytics tool adds a few facts about the app itself: its version and build number, which version of iOS you are running, whether you are on a phone or a tablet, whether the app is a test build, and a session number that groups one visit together. Base removes the rest of what the tool would otherwise attach — your device model, screen size, language, time zone, and whether you are on Wi-Fi or cellular — before anything is sent.

Your Apple Health data is never included. No heart rate, resting heart rate, heart rate variability, heart-rate zones, age, workouts, zone 2 minutes, weekly totals, goal results, or streaks leave your device — not as numbers, not as yes/no flags, not as ranges. The app also never records or uploads pictures of its own screens, because a picture of Base is a picture of your heart data.

Base asks once, on the Week screen, with “Yes, share” and “Don’t share”. You can allow sharing or withdraw your app analytics consent anytime under You → App & privacy → YOUR DATA → “Share usage data”. Neither processor starts until you agree. Before either processor starts after your first agreement, Base removes old locally stored analytics, crash reports and the old identifier; if that cleanup fails, sharing stays off. Activity from before your agreement is not replayed later. Turning sharing off stops new collection and discards the identifier. Before a later opt-in, Base clears the old local state again and creates a fresh identifier.

Withdrawal cannot recall information already sent or an upload already in progress. An already-recorded crash report from a time when you allowed sharing may finish uploading while the crash reporter shuts down. Base does not send a new analytics event to report that you turned sharing off. The cleanup before a later opt-in prevents old cached reports from being uploaded under your new agreement.

Website waitlist and technical information

The waitlist was optional and separate from the app, and closed when Base launched. If you joined, we collected the waitlist email you submitted along with the form’s consent version and a fixed form-source code (including a guide identifier when you joined from a guide), so we can document your request for Base launch and occasional product updates and understand which guides led to signups. This does not capture search terms, URL query parameters, browsing history or Apple Health data.

Cloudflare hosts the website and stores waitlist signups on our behalf. Cloudflare may process ordinary request and security information needed to deliver and protect the service, such as an IP address, browser information, timestamps, and request logs, under its own service terms and privacy commitments. We do not connect website information to Apple Health data.

We do not use advertising pixels, record your browsing sessions, or join website visits to your app identity. Optional website measurement has its own consent choice, described below.

Website privacy choices

Google Analytics runs only if you choose to allow it. Until then, we do not load its tag, send it measurement requests, or set analytics cookies. You can use the website with analytics off. This choice is separate from waitlist email consent and the privacy setting inside the Base app.

If you allow it, we measure which pages are useful and what leads people toward Base: visits to known site pages, a limited set of referral and campaign sources, guide-reading engagement, signup interactions and acknowledged signup requests or errors. When an App Store link is available, we may measure clicks on it — a click is not a download. We do not send form contents, names, email addresses, arbitrary URL queries or fragments, raw referring-page addresses, app identifiers or Apple Health data.

Google also receives technical information needed for those requests, including your IP address and browser and device information, and may derive approximate location. Analytics cookies give the browser a pseudonymous identifier; this is not anonymous data. We do not use Google Signals, advertising personalization, User-ID, session replay or automatic form-content collection, and we do not connect this information to your app or health data.

Your browser stores the consent choice, notice version and expiry for 180 days, not your name or email. After consent, a session-storage record carries only registered source and landing-page values through a 30-minute inactivity window. Google’s _ga and _ga_-prefixed cookies last up to 90 days without extending their expiry on each visit; browser restrictions may shorten that. The account’s event-level and user-level retention is two months, with no reset on new activity. Standard aggregate reports can be retained longer.

Use Privacy choices in the footer to withdraw consent. This stops new measurement, clears the website’s analytics session and accessible Google Analytics cookies, and reloads the page if the tag was running. It does not erase information already sent. Global Privacy Control or Do Not Track keeps optional analytics off. Clearing browser storage removes the remembered choice; each browser or device has its own choice.

Contacting support, and app diagnostics

What you write is your own. Please leave health details out of a support email if you can — we do not need them to help you. If you do include them, we treat them like the rest of the message: used only to answer you and fix the problem, never used for advertising or sold, and deleted along with the correspondence if you ask.

We hold support email as ordinary correspondence linked to your email address, and we keep it no longer than we need to resolve your issue — normally up to 24 months — unless you ask us to delete it sooner. Ask at the address below and we will delete it.

If you test Base through TestFlight, Apple shares tester information with us, and what we get depends on how you joined and what you send:

• Automatically, for every tester: a device identifier, information about how you used the build, and crash logs.
• Your name and email address: only if we invited you by email. If you joined through a public TestFlight link, Apple does not show us the name or email you enrolled with — though anything you type into feedback, including an email address, does reach us.
• Anything you choose to send: TestFlight feedback you submit — your comments and any screenshots — comes to us with the build and device details attached.

We use all of it only to run the test: to understand a crash, to reply to your feedback, and to know which build you were on. We do not use it for advertising, we do not sell it, and Apple's rules do not allow us to share TestFlight information with anyone else. We keep our copies while the test is running and for up to 12 months afterwards, then delete them, and we will delete them sooner if you ask — that covers the copies we hold, not Apple's own records, which Apple keeps under its own policy. You can stop testing at any time; note that stopping does not delete the build already on your device, and a build keeps working until it expires, so use Delete App if you want it gone.

Separately, Apple operates its own crash reporting for every app, and Base has not turned it off. There are two situations. If you use Base from the App Store, Apple sends us its crash reports only when you have Share With App Developers enabled in iOS Settings under Privacy & Security, Analytics & Improvements; those reports describe the technical state of a crash and carry no Apple Health data. We use them for one thing — finding and fixing the crash — and never for advertising, and we never sell them. They reach us through App Store Connect and Xcode, where Apple controls how long they stay available; the copies we download we keep no longer than we need to fix the problem, normally up to 12 months, and you can turn the whole thing off at any time in that iOS setting. If you test Base through TestFlight, Apple's collection is automatic and cannot be turned off by you, and what Apple may make available to us is broader — it can include your name and email address, a device identifier, usage information, and crash logs, as described in Apple's TestFlight privacy notice. We tell testers this when we invite them.

Purposes and legal bases

Where a law requires legal bases, we rely on your separate consent for optional website analytics and waitlist messages; your request and our legitimate interest in answering you for support correspondence; your request, choices, and our contract with you to provide Base; our legitimate interests in operating and securing the website and answering requests; and legal obligations when applicable. You may withdraw website analytics or waitlist consent separately at any time without affecting earlier lawful handling.

For optional app usage analytics and crash reporting, we rely on your consent to understand whether Base works, diagnose crashes and see where people get stuck. Refusing does not prevent you from using Base. Turn off “Share usage data” to withdraw; this stops new collection without affecting earlier lawful processing. This choice is separate from Apple Health permission, website analytics, waitlist messages and Apple’s own TestFlight reporting.

Service providers, Apple, and international processing

Cloudflare is our current website hosting and form service provider. Waitlist and technical website information may be processed in the United States and other locations where Cloudflare operates. Cloudflare states that it participates in the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework. When a restricted transfer is not covered by those frameworks, Cloudflare’s data processing addendum provides the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

You can review Cloudflare’s Privacy Policy and Customer Data Processing Addendum, or email us for more information about these safeguards.

Google processes optional website analytics for us under its applicable Analytics and data-processing terms. Processing may take place in the United States and other countries where Google operates. Google’s Data Processing Terms describe the applicable international-transfer safeguards; its Privacy Policy explains its handling of information. We do not share website analytics with advertising accounts.

PostHog provides optional app usage analytics and Sentry provides optional crash reporting under data-processing agreements with Base Cardio LLC. We use their EU-hosted services, but EU hosting does not mean all processing occurs only in the EU. Their agreements describe the safeguards that apply to international processing and use of subprocessors. You can review PostHog’s DPA and Sentry’s DPA, or contact us for information about these arrangements.

Apple independently operates Apple Health, the App Store, StoreKit, and App Store payments under Apple’s terms and privacy policy. We do not receive your payment-card information. The app receives entitlement information from Apple on your device so it can unlock the purchase you made.

Retention

App health information remains on your devices while needed for Base’s features and while the app is installed, subject to reconciliation when Apple Health reports a deletion. Uninstalling Base removes its app container. A workout Base saved to Apple Health remains in Apple Health until you delete it there.

We delete waitlist information when you unsubscribe or ask us to delete it. Otherwise, we keep it no longer than the earlier of 24 months after signup or 12 months after Base’s public launch. We may retain a minimal suppression record when necessary to honor an opt-out or meet a legal obligation.

We keep TestFlight tester information while the test programme runs and for up to 12 months after it ends, or until you ask us to delete it.

We use PostHog’s EU service for optional app usage analytics. Our current free plan provides a one-year event-analysis window. This window limits the events available for analysis; it is not a guarantee that older data is physically deleted. Deletion is handled separately through PostHog’s deletion procedures, including applicable individual deletion requests and project closure, subject to legal requirements. We use Sentry’s EU service for optional crash reporting. Error reports received under our current Developer plan have a 30-day retention window; reports received under a different plan or trial may have a different period. Processing and backup handling follow the applicable provider procedures and legal requirements. Contact us about deletion requests.

These app reports use a random identifier created after you agree to sharing, not your name, email or an account. Reports already received remain subject to the vendor retention and deletion practices described here. Turning off “Share usage data” stops new collection and discards the local identifier; it does not delete server-side records. Deleting Base removes its local app data. A later opt-in uses a new identifier after clearing old local state, with the shutdown limit described above.

That also marks the honest limit of what we can do on request: because the identifier is random and we hold nothing that ties it to your name or email, we normally cannot find one person’s records in order to delete them, and we will not ask you for more information about yourself in order to try. If you can tell us the identifier, we will ask both processors to erase what is held under it.

We keep support correspondence, including any diagnostics that were in the message you sent, for as long as needed to resolve your issue and normally no longer than 24 months, or until you ask us to delete it. The performance summary on your device holds only the last five summaries Base has built from what iOS reported. We store it in a file we mark for exclusion from backups, and Base never uploads it anywhere on its own. Deleting Base removes that file from your device.

Hosting and security logs follow Cloudflare’s applicable retention practices.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information we hold, and to withdraw consent. You may also have a right to appeal a refusal. Email hello@basecardio.com to make a request or privacy complaint. We may need to verify that the request concerns your email, and we will respond within the deadline required by applicable law.

You may complain to the privacy regulator where you live, including the Office of the Privacy Commissioner of Canada, the UK Information Commissioner’s Office, Ireland’s Data Protection Commission, the Office of the Australian Information Commissioner, New Zealand’s Office of the Privacy Commissioner, Singapore’s Personal Data Protection Commission, or South Africa’s Information Regulator. United States residents may also contact their state attorney general where applicable.

Children

Base is not directed to children under 13, and the website waitlist is not intended for anyone under 16. We do not knowingly collect a child’s waitlist email. If you believe a child submitted one, contact us and we will delete it.

Security

We use safeguards appropriate to the information we handle, including keeping app health processing on-device and limiting website collection. No system is perfectly secure, so we cannot guarantee absolute security.

Changes and contact

If this notice materially changes, we will update the effective date and provide additional notice where appropriate or legally required. We will request any consent required before using information for a materially different purpose.

Questions, requests, or complaints can be sent to hello@basecardio.com or mailed to the address above.